diff --git a/birdnet-pipy/rootfs/etc/cont-init.d/15-audio_perms.sh b/birdnet-pipy/rootfs/etc/cont-init.d/15-audio_perms.sh
index 162fbd319..3752d6d86 100755
--- a/birdnet-pipy/rootfs/etc/cont-init.d/15-audio_perms.sh
+++ b/birdnet-pipy/rootfs/etc/cont-init.d/15-audio_perms.sh
@@ -14,8 +14,32 @@ if [ -n "${SND_GID}" ] && getent group audio >/dev/null 2>&1; then
   fi
 fi
 
-for u in root nginx www-data; do
+for u in root nginx www-data icecast2; do
   if id "${u}" >/dev/null 2>&1; then
     usermod -aG audio "${u}" 2>/dev/null || true
   fi
 done
+
+# Create /run/pulse/native symlink if the PulseAudio socket is elsewhere
+# (e.g. HAOS provides it at /run/audio/pulse.sock)
+PULSE_SOCK="${PULSE_SERVER:-}"
+PULSE_SOCK="${PULSE_SOCK#unix:}"
+if [ -n "${PULSE_SOCK}" ] && [ -S "${PULSE_SOCK}" ] && [ ! -S /run/pulse/native ]; then
+  mkdir -p /run/pulse
+  ln -sf "${PULSE_SOCK}" /run/pulse/native
+fi
+
+# Copy PulseAudio cookie for the icecast2 user so it can authenticate
+if id icecast2 >/dev/null 2>&1; then
+  ICECAST_HOME="$(getent passwd icecast2 | cut -d: -f6)"
+  if [ -n "${ICECAST_HOME}" ]; then
+    for cookie in /config/.config/pulse/cookie /root/.config/pulse/cookie; do
+      if [ -f "${cookie}" ]; then
+        mkdir -p "${ICECAST_HOME}/.config/pulse"
+        cp "${cookie}" "${ICECAST_HOME}/.config/pulse/cookie"
+        chown icecast2 "${ICECAST_HOME}/.config/pulse" "${ICECAST_HOME}/.config/pulse/cookie"
+        break
+      fi
+    done
+  fi
+fi
diff --git a/birdnet-pipy/rootfs/etc/services.d/icecast/run b/birdnet-pipy/rootfs/etc/services.d/icecast/run
index 220df56dc..8a608c9a5 100644
--- a/birdnet-pipy/rootfs/etc/services.d/icecast/run
+++ b/birdnet-pipy/rootfs/etc/services.d/icecast/run
@@ -1,5 +1,5 @@
 #!/usr/bin/with-contenv bashio
 # shellcheck shell=bash
 set -euo pipefail
-export PULSE_SERVER=unix:/run/pulse/native
+export PULSE_SERVER="${PULSE_SERVER:-unix:/run/pulse/native}"
 gosu icecast2 /usr/local/bin/start-icecast.sh
diff --git a/birdnet-pipy/rootfs/etc/services.d/main/run b/birdnet-pipy/rootfs/etc/services.d/main/run
index 0ceae662a..68d4ae1d1 100644
--- a/birdnet-pipy/rootfs/etc/services.d/main/run
+++ b/birdnet-pipy/rootfs/etc/services.d/main/run
@@ -2,7 +2,7 @@
 # shellcheck shell=bash
 set -euo pipefail
 export PYTHONPATH=/app
-export PULSE_SERVER=unix:/run/pulse/native
+export PULSE_SERVER="${PULSE_SERVER:-unix:/run/pulse/native}"
 bashio::net.wait_for 5002 127.0.0.1 300
 cd /app
 exec python3 -m core.main